CVE-2019-8113

Summary (CVE-2019-8113): Magento 2.2 versions before 2.2.10 and Magento 2.3 versions before 2.3.3 (or 2.3.2-p1) use a cryptographically weak random number generator to brute‑force the confirmation code during customer registration. This is mitigated by applying the security update referenced (Mag...

CVE-2019-8112

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...

CVE-2019-8112

CVE-2019-8112 affects Magento Open Source/Commerce: unauthenticated attackers can bypass email confirmation via a GET request, leveraging data from the POST response during new user creation. Affected versions are Magento 2.2 prior to 2.2.10 and Magento 2.3 prior to 2.3.3 or 2.3.2-p1. The documen...

CVE-2019-8111

CVE-2019-8111 affects Magento: Magento 2.2.x before 2.2.10 and Magento 2.3.x before 2.3.3 (or 2.3.2-p1) are vulnerable. An authenticated user can use email-template plugin functionality to manipulate the interceptor class, enabling remote code execution. The vulnerability description is consisten...

CVE-2019-8111

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage plugin functionality related to email templates to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code...

CVE-2019-8110

CVE-2019-8110 describes a remote code execution in Magento 2.2 (pre-2.2.10) and 2.3 (pre-2.3.3 or pre-2.3.2-p1). An authenticated attacker can abuse the email templates hierarchy to manipulate the interceptor class, allowing arbitrary code execution. The entry is corroborated across multiple feed...

CVE-2019-8110

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage email templates hierarchy to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code...

CVE-2019-8109

CVE-2019-8109 affects Magento: Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3 (or 2.3.2-p1) are vulnerable. An authenticated user can craft a malicious CSRF payload that results in arbitrary command execution (remote code execution). The vulnerability is addressed by...

CVE-2019-8109

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a malicious CSRF payload that can result in arbitrary command execution...

CVE-2019-8090

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature...

CVE-2019-8090

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature...

Arbitrary file deletion

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature...

CVE-2019-8108

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate session validation setting for a storefront that leads to insecure authentication and session management...

CVE-2019-8108

Magento reports an Insecure Authentication and Session Management vulnerability affecting Magento 2.2.x before 2.2.10 and 2.3.x before 2.3.3 (or 2.3.2-p1). An authenticated user can manipulate the storefront’s session validation setting, enabling insecure authentication/session handling. Public r...

CVE-2019-8107

CVE-2019-8107 affects Magento 2.2 (<2.2.10) and 2.3 (<2.3.3 or

CVE-2019-8107

An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with export data transfer privileges can craft a request to perform arbitrary file deletion...

CVE-2019-8091

CVE-2019-8091 is a remote code execution vulnerability in Magento 1.x prior to 1.9.4.3 and Magento 1.14.4.3. An authenticated admin user with privileges to access product attributes can exploit layout updates to trigger code execution. Affected products: Magento Open Source before 1.9.4.3 and Mag...

CVE-2019-8091

A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution...

CVE-2019-8093

An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage file upload controller for downloadable products to read/delete an arbitary files...

CVE-2019-8093

Magento 2.2.x before 2.2.10 and 2.3.x before 2.3.3 (or 2.3.2-p1) contain an arbitrary file access vulnerability. An authenticated user can abuse the file upload controller for downloadable products to read or delete arbitrary files. Remediation: apply the Magento security patches 2.2.10 and 2.3.3...